
(U) Converged Analysis of 
Smartphone Devices 




Identification/Processing/Tasking - 



All in a day’s work 




TOP SECRET//COMINT/REL TO USA, FVEY 





Converged mobile devices 
offering advanced capabilities, 
often with PC-like 
functionality. No set industry 
standard definition. 

Boasts powerful processors, 
memory, larger screens and 
open operating systems. 
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The gradual “blurring” of 
telecommunications, computers, and the 
Internet 

Multifaceted layering technologies 
Examples of convergence in SIGINT: 

> Blackberry, iPhone data, Smartphones 

> VOIP 

> Wireless Local Loop 

> GPRS - General Packet Radio Service 
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SmartPhone Applications 



Visual Communicator - Free application that 
combines Instant Messaging, Photo-Messaging 
and Push2Talk capabilities on a mobile 
ilatform. VC used on GPRS or 3G networks; 



Symbian Operating System supporting 
encryption programs. 

WinZip, compression and encryption program. 
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■ Social Networking via Flixster 

■ Social Networking site allowing users to share 
i movie ratings, discover new movies and meet 

I others with similar movie taste. 

■ Google Maps features 

■ Photo capture and editing capabilities 

■ Phone settings 

■ Mobile Facebook Apps (iPhone/ Android) 
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JtATl SO* 



Where is the target? 



GPRS Dataset - breaking down barriers 
Providers catering to users based on location 
Android Phones pass GPS data in the clear 
No longer DNI/DNR 
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Location Based Services 




TOP SECRET//COMINT/REL TO USA, FVEY 



Photo Capture Software - 

■ iPhone Geotags for Photos 

Raw tags coming through from a variety of 
devices 

■ Flixster App uses GPRS 

■ Flickr/Photobucket 

■ Mobile FacebookApps Uploads 
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All in the Metadata, not the pretty pictures 

W ■ Unique applications require unique analysis 

r ■ GPS Indicators (sent to the server and towers 

for both phone and application) 

■ VoIP Indicators (multiple services) 

■ Type of Phone and Apps 





Make use of fingerprints in Xkeyscore via the 
EXIF metadata plugin 

Fingerprints for images (jpeg, tiff, gifs etc.) 

Examine the raw XML 

Provides device and time/location for the image 
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Golden Nugget! 



Perfect Scenario - Target uploading 
photo to a social media site taken 
with a mobile device. 

What can we get? 
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JtATl SO* 



Examine settings of phone as well as service 
providers for geo-location; specific to a certain 
region 

Networks connected 
Websites visited 
Buddy Lists 

Documents Downloaded 
Encryption used and supported 
User Agents 
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User Activity Leads 





Targeting both Telephony and DNI systems 
Call Logs 
SMS 

SIM Card Leads 
Email address 
IMEI/IMSI 
Unique Identifiers 
Blackberry PINS 
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'Additional exploitation 
'Target Knowledge/Leads 
'Location 



'Target Technology 
'Denote Media used 




Challenge is how to tag data for analysts 
We can geo phones from virtually anywhere 
Buried GeoStamp from Phone or Apps 
Xkeyscore/Marina 

Tasking systems ryy 
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